1. Field of the Invention
The present invention is related to security authentication in computer systems, and more specifically to an authentication system that provides unified user identification across multiple namespaces.
2. Description of Related Art
In networked computer systems, and in particular, in heterogeneous networking environments across multiple operating systems, entity authentication presents a management challenge. Entities, or in the present context, security principals, may be individual users, groups, particular machines, and the like. Entities are typically externally identified by a user ID or name that provides a symbolic tag, but internally, a numeric tag is typically associated with the entity as a practical measure. The numeric tag then provides a uniform identifier in the particular environment, such as security identifier objects (SIDs) used in Microsoft WINDOWS, or group and user identifiers as used in UNIX-type operating systems. (UNIX is a trademark of The Open Group.) Application programming interfaces (APIs) that access secured objects generally require such a numeric tag as an input, either directly or implicitly, as do gateways such as network portals.
Typically, an external database is used to map an entity identifier from one namespace to all of the various namespaces that the entity might encounter. An entity should be able to access the same set of objects irrespective of the operating system, network, machine, etc. from which an access occurs. Therefore, a large number of mappings may be required to and from various namespaces associated with various operating systems, machines and in some instances particular sub-systems or applications. Such identifier mappings have several drawbacks. First, the database must typically be fully populated before use, which is a labor-intensive process and has a high barrier to entry. Second, the reliance on an external database is a security vulnerability that is continuously exposed. Finally, it is frequently impractical to query a platform-specific database from a different platform, making the interface to the external database awkward for at least some of the access paths.
Therefore, it would be desirable to provide an identification method and system that provides uniform identification, can provide automatic population of identifiers and that adapts easily to access paths from different platforms.